A site security assessment is a walk. You start at the fence line and finish in the server room, and the value sits in what you wrote down along the way. This checklist runs 101 points, sized for one afternoon.

Score every point Adequate, Needs Improvement, Deficient or N/A, and photograph anything you mark Deficient. Rank deficiencies by consequence rather than by what is cheap to fix, and attach a cost estimate to each recommendation. The same 101 points serve a first site survey, an annual re-audit, and a pre-bid walk with a prospect.

Nothing here replaces the code that applies to the building. Egress, fire and life safety items are governed by federal rules and by whatever the local fire marshal enforces on top of them. When a finding touches either, write the code reference next to it.

How do you score each item?

✓ Adequate: Meets the requirement as written
△ Needs Improvement: Functional, but a reasonable person would upgrade it
✗ Deficient: A real gap, with a plausible way to exploit it
N/A: Not applicable to this site

Photograph every ✗ and note where you stood. A report that says "inadequate perimeter lighting" starts an argument. A photo of the northwest corner at 10pm ends one.

Perimeter, exterior and lighting (31 points)

Walk the whole fence line, including the part nobody drives past. Gaps grow where the property is not seen: behind the dumpster enclosure, at the back corner where the vegetation came in, at the gate a contractor has been propping open since spring. Assess lighting after dark or do not assess it.

Fencing, gates and sightlines

☐ Perimeter fence in good condition (no gaps, holes, or damage)
☐ Fence height matched to the threat (confirm what local code and the client's insurer require)
☐ Anti-climb measures installed (barbed wire, rotating toppers) where appropriate
☐ Vehicle barriers at entrances (bollards, planters, gates)
☐ No climbable objects near fence line (dumpsters, trees, pallets)
☐ All gates lockable and in good working order
☐ Vehicle gates have anti-tailgating measures
☐ Pedestrian gates separate from vehicle entry where possible
☐ Emergency vehicle access maintained
☐ Clear sightlines along perimeter (vegetation maintained)
☐ Perimeter lighting adequate (no dark spots)
☐ Camera coverage of perimeter and entry points

Doors, windows and other openings

☐ All exterior doors solid-core or metal construction
☐ Door frames reinforced (anti-pry plates installed)
☐ Hinges on secure side (interior) or have non-removable pins
☐ All doors close and latch properly
☐ Emergency exits alarmed and cannot be opened from outside
☐ Loading dock doors secured when not in use
☐ Ground floor windows have locks or security film
☐ No windows left open or unsecured after hours
☐ Skylights and roof access points secured
☐ Utility openings (HVAC, vents) secured against entry
☐ Roof access secured (locked hatches, ladder guards)

Lighting

☐ Parking lots evenly lit at ground level, no pooling and no dark lanes (get the foot-candle target from the client's engineer)
☐ Building entrances well lit, no shadows at the door
☐ Perimeter continuously lit, no dark gaps
☐ Stairwells lit at all landings
☐ Emergency lighting functional on generator or battery
☐ Burned out lights replaced promptly, with a maintenance process behind it
☐ Lighting protected from vandalism where reachable
☐ Motion-activated lights in low-traffic areas

The same walk tells you where the tour stops belong. Placing checkpoints where an intruder would actually go covers how to turn findings into a patrol route.

Access control and key control (15 points)

Most access control failures are administrative, not technical. The reader works fine. The badge that opened it belongs to someone who resigned in March and never handed it back.

☐ Access control system installed at appropriate entry points
☐ Credential type appropriate for security level (cards, fobs, biometric)
☐ Anti-passback or tailgating prevention measures
☐ Access levels defined by area sensitivity
☐ Visitor credentials distinguishable from employee credentials
☐ Process for issuing new credentials documented
☐ Timely deactivation of lost or stolen credentials
☐ Terminated employee credentials deactivated immediately
☐ Temporary and contractor credentials have expiration dates
☐ Regular audit of active credentials conducted
☐ Master key system with limited distribution
☐ Key log maintained with sign-out procedures
☐ Key audit conducted regularly
☐ Locks rekeyed when keys are lost or unreturned
☐ High-security areas use restricted keyways

If the key log is a clipboard nobody has signed in two years, that is a finding on its own. Hand the client the key control policy template, and read access control beyond badge readers for what should replace the keys.

Cameras and alarm systems (18 points)

Coverage and resolution are two different questions. A camera that sees a person is not a camera that identifies one, and the difference only shows up when someone asks for footage.

☐ All entry and exit points covered
☐ Parking areas covered
☐ Loading dock and delivery areas covered
☐ High-value or sensitive areas covered
☐ Stairwells and elevators covered
☐ No blind spots in critical areas
☐ Camera resolution adequate for identification, not just detection
☐ Night vision or IR capability where needed
☐ Recording system functional with adequate storage
☐ Retention period meets legal and policy requirements
☐ Intrusion detection covers all perimeter doors
☐ Motion sensors in interior areas after hours
☐ Glass break sensors on vulnerable windows
☐ Panic or duress buttons at appropriate locations
☐ Alarm monitoring, 24/7 central station or in-house
☐ Response procedures documented and tested
☐ Regular testing of all sensors, documented
☐ False alarm reduction measures in place

Ask what happened on the last alarm activation. If nobody can tell you, the response procedure exists on paper only, and that belongs in the report next to the sensor coverage.

Fire and life safety minimums (10 points)

Two federal rules set the floor here, and both are worth quoting back to a client who wants to argue. Exit routes must be free, unobstructed and adequately lighted, and each exit must be marked by a sign reading "Exit" with letters at least six inches high, illuminated to at least five foot-candles, per 29 CFR 1910.37. Portable fire extinguishers must be visually inspected monthly and given an annual maintenance check, with the maintenance date recorded, under 29 CFR 1910.157.

☐ Fire alarm system functional and tested regularly
☐ Sprinkler system operational where installed
☐ Fire extinguishers: proper type, monthly inspection tag current, unobstructed
☐ Emergency exits marked, unobstructed, functional
☐ Exit signs illuminated and visible from all areas
☐ Emergency lighting tested and functional
☐ Evacuation routes posted and current
☐ Assembly areas designated and communicated
☐ Fire drills conducted at required intervals
☐ AED locations accessible and maintained

Check the extinguisher tags. It takes ninety seconds and it is the most common finding on a first walk.

Security operations and documentation (12 points)

☐ Staffing levels appropriate for site size and risk
☐ Coverage maintained during breaks and shift changes
☐ Response times to incidents are acceptable
☐ Post orders current and accessible on post
☐ Emergency procedures documented
☐ Incident reports completed properly
☐ Daily activity logs maintained
☐ Visitor logs complete and legible
☐ Radio communication functional throughout site
☐ Emergency contact lists current
☐ Chain of command documented
☐ Communication with local law enforcement established

Read the post orders on post, not the copy in the client's binder. If the two disagree, or the on-post set still names a supervisor who left, that is the finding. Writing post orders guards will actually follow covers the fix, and the daily activity report template covers the log that should sit beside them.

Visitors, employees and assets (15 points)

☐ Employee ID badges issued and worn
☐ Badge challenge culture established
☐ Visitor sign-in procedures enforced
☐ Visitor badges distinguishable and collected on departure
☐ Escort policy for visitors in sensitive areas
☐ Contractor and vendor credentialing process exists
☐ Background checks conducted for employees with access
☐ Terminated employee access removal process exists
☐ Sensitive documents secured (locked cabinets, clean desk policy)
☐ Computer screens positioned away from public view
☐ Server and data rooms have restricted access
☐ Shredding or secure disposal available for sensitive documents
☐ Laptop locks or secured storage available
☐ Inventory of high-value assets maintained
☐ Package and mail screening procedures where warranted

Test the sign-in rather than reading it. Walk to the desk without a badge and see what happens. The written procedure and the one the receptionist runs at 4:45pm on a Friday are frequently different documents, which is the argument for the visitor management SOP.

How should you rank what you found?

By consequence, not by cost. A $40 padlock finding can outrank a $40,000 camera finding.

Priority	Criteria	Action Timeline
Critical	Immediate life safety or major security gap	Address within 24 to 48 hours
High	Significant vulnerability, moderate likelihood	Address within 30 days
Medium	Minor vulnerability or enhancement opportunity	Address within 90 days
Low	Best practice recommendation, low risk	Include in next budget cycle

What goes in the report?

Executive summary: overall posture and the top three priorities, on one page
Methodology: when you walked, what you could and could not access
Findings by category: the sections above, with the photos
Recommendations: ranked, with cost estimates the client can put in a budget line
Implementation timeline: what gets fixed this month and what waits for capital
Appendices: photos, site diagram, the completed checklist itself

The cost estimates are what turn the report into work. A finding without a number attached sits in a drawer until the next assessment repeats it.

If you are assessing a house of worship, a school or a small nonprofit with no security program at all, CISA runs a free walk-through called Security Assessment at First Entry, which produces a report in under two hours at no cost. Worth telling a prospect about when their budget is genuinely zero.

Key Takeaways

Assess annually, and again after any change to the building, tenant mix or hours.
Rank findings by consequence. Cheap fixes float to the top on their own.
Photograph every deficiency and record where you were standing.
Attach a cost estimate to every recommendation or it will not be actioned.
Open the next assessment with last year's recommendations and mark what closed.

How do you score each item?

✓ Adequate: Meets the requirement as written
△ Needs Improvement: Functional, but a reasonable person would upgrade it
✗ Deficient: A real gap, with a plausible way to exploit it
N/A: Not applicable to this site

Photograph every ✗ and note where you stood. A report that says "inadequate perimeter lighting" starts an argument. A photo of the northwest corner at 10pm ends one.